8 files changed, 196 insertions, 133 deletions

diff --git a/spec/policies/ci/bridge_policy_spec.rb b/spec/policies/ci/bridge_policy_spec.rb
index e598e2f7626..d23355b4c1e 100644
--- a/spec/policies/ci/bridge_policy_spec.rb
+++ b/spec/policies/ci/bridge_policy_spec.rb
@@ -13,6 +13,8 @@ RSpec.describe Ci::BridgePolicy do
     described_class.new(user, bridge)
   end
 
+  it_behaves_like 'a deployable job policy', :ci_bridge
+
   describe '#play_job' do
     before do
       fake_access = double('Gitlab::UserAccess')
diff --git a/spec/policies/ci/build_policy_spec.rb b/spec/policies/ci/build_policy_spec.rb
index ec3b3fde719..6ab89daff82 100644
--- a/spec/policies/ci/build_policy_spec.rb
+++ b/spec/policies/ci/build_policy_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-RSpec.describe Ci::BuildPolicy do
+RSpec.describe Ci::BuildPolicy, feature_category: :continuous_integration do
   let(:user) { create(:user) }
   let(:build) { create(:ci_build, pipeline: pipeline) }
   let(:pipeline) { create(:ci_empty_pipeline, project: project) }
@@ -11,6 +11,8 @@ RSpec.describe Ci::BuildPolicy do
     described_class.new(user, build)
   end
 
+  it_behaves_like 'a deployable job policy', :ci_build
+
   shared_context 'public pipelines disabled' do
     before do
       project.update_attribute(:public_builds, false)
@@ -99,12 +101,15 @@ RSpec.describe Ci::BuildPolicy do
 
       context 'when maintainer is allowed to push to pipeline branch' do
         let(:project) { create(:project, :public) }
-        let(:owner) { user }
 
-        it 'enables update_build if user is maintainer' do
-          allow_any_instance_of(Project).to receive(:empty_repo?).and_return(false)
-          allow_any_instance_of(Project).to receive(:branch_allows_collaboration?).and_return(true)
+        before do
+          project.add_maintainer(user)
 
+          allow(project).to receive(:empty_repo?).and_return(false)
+          allow(project).to receive(:branch_allows_collaboration?).and_return(true)
+        end
+
+        it 'enables update_build if user is maintainer' do
           expect(policy).to be_allowed :update_build
           expect(policy).to be_allowed :update_commit_status
         end
@@ -127,6 +132,16 @@ RSpec.describe Ci::BuildPolicy do
         it 'does not include ability to update build' do
           expect(policy).to be_disallowed :update_build
         end
+
+        context 'when the user is admin', :enable_admin_mode do
+          before do
+            user.update!(admin: true)
+          end
+
+          it 'does not include ability to update build' do
+            expect(policy).to be_disallowed :update_build
+          end
+        end
       end
 
       context 'when developers can push to the branch' do
@@ -252,7 +267,7 @@ RSpec.describe Ci::BuildPolicy do
             create(:protected_branch, :developers_can_push, name: build.ref, project: project)
           end
 
-          it { expect(policy).to be_allowed :erase_build }
+          it { expect(policy).to be_disallowed :erase_build }
         end
 
         context 'when the build was created for a protected tag' do
@@ -262,7 +277,7 @@ RSpec.describe Ci::BuildPolicy do
             build.update!(tag: true)
           end
 
-          it { expect(policy).to be_allowed :erase_build }
+          it { expect(policy).to be_disallowed :erase_build }
         end
 
         context 'when the build was created for an unprotected ref' do
diff --git a/spec/policies/deploy_key_policy_spec.rb b/spec/policies/deploy_key_policy_spec.rb
index d84b80a8738..754f36ce3b0 100644
--- a/spec/policies/deploy_key_policy_spec.rb
+++ b/spec/policies/deploy_key_policy_spec.rb
@@ -2,69 +2,89 @@
 
 require 'spec_helper'
 
-RSpec.describe DeployKeyPolicy do
+RSpec.describe DeployKeyPolicy, feature_category: :groups_and_projects do
   subject { described_class.new(current_user, deploy_key) }
 
-  describe 'updating a deploy_key' do
-    context 'when a regular user' do
-      let(:current_user) { create(:user) }
+  let_it_be(:current_user, refind: true) { create(:user) }
+  let_it_be(:admin) { create(:user, :admin) }
 
-      context 'tries to update private deploy key attached to project' do
-        let(:deploy_key) { create(:deploy_key, public: false) }
-        let(:project) { create(:project_empty_repo) }
+  context 'when deploy key is public' do
+    let_it_be(:deploy_key) { create(:deploy_key, public: true) }
 
-        before do
-          project.add_maintainer(current_user)
-          project.deploy_keys << deploy_key
-        end
+    context 'and current_user is nil' do
+      let(:current_user) { nil }
 
-        it { is_expected.to be_allowed(:update_deploy_key) }
-      end
+      it { is_expected.to be_disallowed(:read_deploy_key) }
+
+      it { is_expected.to be_disallowed(:update_deploy_key) }
+    end
 
-      context 'tries to update private deploy key attached to other project' do
-        let(:deploy_key) { create(:deploy_key, public: false) }
-        let(:other_project) { create(:project_empty_repo) }
+    context 'and current_user is present' do
+      it { is_expected.to be_allowed(:read_deploy_key) }
 
-        before do
-          other_project.deploy_keys << deploy_key
-        end
+      it { is_expected.to be_disallowed(:update_deploy_key) }
+    end
 
-        it { is_expected.to be_disallowed(:update_deploy_key) }
+    context 'when current_user is admin' do
+      let(:current_user) { admin }
+
+      context 'when admin mode enabled', :enable_admin_mode do
+        it { is_expected.to be_allowed(:read_deploy_key) }
+
+        it { is_expected.to be_allowed(:update_deploy_key) }
       end
 
-      context 'tries to update public deploy key' do
-        let(:deploy_key) { create(:another_deploy_key, public: true) }
+      context 'when admin mode disabled' do
+        it { is_expected.to be_allowed(:read_deploy_key) }
 
         it { is_expected.to be_disallowed(:update_deploy_key) }
       end
     end
+  end
+
+  context 'when deploy key is private' do
+    let_it_be(:deploy_key) { create(:deploy_key, :private) }
+
+    context 'and current_user is nil' do
+      let(:current_user) { nil }
 
-    context 'when an admin user' do
-      let(:current_user) { create(:user, :admin) }
+      it { is_expected.to be_disallowed(:read_deploy_key) }
 
-      context 'tries to update private deploy key' do
-        let(:deploy_key) { create(:deploy_key, public: false) }
+      it { is_expected.to be_disallowed(:update_deploy_key) }
+    end
+
+    context 'when current_user is admin' do
+      let(:current_user) { admin }
 
-        context 'when admin mode enabled', :enable_admin_mode do
-          it { is_expected.to be_allowed(:update_deploy_key) }
-        end
+      context 'when admin mode enabled', :enable_admin_mode do
+        it { is_expected.to be_allowed(:read_deploy_key) }
 
-        context 'when admin mode disabled' do
-          it { is_expected.to be_disallowed(:update_deploy_key) }
-        end
+        it { is_expected.to be_allowed(:update_deploy_key) }
       end
 
-      context 'when an admin user tries to update public deploy key' do
-        let(:deploy_key) { create(:another_deploy_key, public: true) }
+      context 'when admin mode disabled' do
+        it { is_expected.to be_disallowed(:read_deploy_key) }
+
+        it { is_expected.to be_disallowed(:update_deploy_key) }
+      end
+    end
 
-        context 'when admin mode enabled', :enable_admin_mode do
-          it { is_expected.to be_allowed(:update_deploy_key) }
-        end
+    context 'when assigned to the project' do
+      let_it_be(:deploy_keys_project) { create(:deploy_keys_project, deploy_key: deploy_key) }
 
-        context 'when admin mode disabled' do
-          it { is_expected.to be_disallowed(:update_deploy_key) }
-        end
+      before_all do
+        deploy_keys_project.project.add_maintainer(current_user)
       end
+
+      it { is_expected.to be_allowed(:read_deploy_key) }
+
+      it { is_expected.to be_allowed(:update_deploy_key) }
+    end
+
+    context 'when assigned to another project' do
+      it { is_expected.to be_disallowed(:read_deploy_key) }
+
+      it { is_expected.to be_disallowed(:update_deploy_key) }
     end
   end
 end
diff --git a/spec/policies/metrics/dashboard/annotation_policy_spec.rb b/spec/policies/metrics/dashboard/annotation_policy_spec.rb
deleted file mode 100644
index 2d1ef0ee0cb..00000000000
--- a/spec/policies/metrics/dashboard/annotation_policy_spec.rb
+++ /dev/null
@@ -1,67 +0,0 @@
-# frozen_string_literal: true
-
-require 'spec_helper'
-
-RSpec.describe Metrics::Dashboard::AnnotationPolicy, :models do
-  let(:policy) { described_class.new(user, annotation) }
-
-  let_it_be(:user) { create(:user) }
-
-  shared_examples 'metrics dashboard annotation policy' do
-    context 'when guest' do
-      before do
-        project.add_guest(user)
-      end
-
-      it { expect(policy).to be_disallowed :read_metrics_dashboard_annotation }
-      it { expect(policy).to be_disallowed :admin_metrics_dashboard_annotation }
-    end
-
-    context 'when reporter' do
-      before do
-        project.add_reporter(user)
-      end
-
-      it { expect(policy).to be_allowed :read_metrics_dashboard_annotation }
-      it { expect(policy).to be_disallowed :admin_metrics_dashboard_annotation }
-    end
-
-    context 'when developer' do
-      before do
-        project.add_developer(user)
-      end
-
-      it { expect(policy).to be_allowed :read_metrics_dashboard_annotation }
-      it { expect(policy).to be_allowed :admin_metrics_dashboard_annotation }
-    end
-
-    context 'when maintainer' do
-      before do
-        project.add_maintainer(user)
-      end
-
-      it { expect(policy).to be_allowed :read_metrics_dashboard_annotation }
-      it { expect(policy).to be_allowed :admin_metrics_dashboard_annotation }
-    end
-  end
-
-  describe 'rules' do
-    context 'environments annotation' do
-      let_it_be(:environment) { create(:environment) }
-      let_it_be(:annotation) { create(:metrics_dashboard_annotation, environment: environment) }
-
-      it_behaves_like 'metrics dashboard annotation policy' do
-        let(:project) { environment.project }
-      end
-    end
-
-    context 'cluster annotation' do
-      let_it_be(:cluster) { create(:cluster, :project) }
-      let_it_be(:annotation) { create(:metrics_dashboard_annotation, environment: nil, cluster: cluster) }
-
-      it_behaves_like 'metrics dashboard annotation policy' do
-        let(:project) { cluster.project }
-      end
-    end
-  end
-end
diff --git a/spec/policies/organizations/organization_policy_spec.rb b/spec/policies/organizations/organization_policy_spec.rb
index 52d5a41aa7f..e51362227c9 100644
--- a/spec/policies/organizations/organization_policy_spec.rb
+++ b/spec/policies/organizations/organization_policy_spec.rb
@@ -7,21 +7,33 @@ RSpec.describe Organizations::OrganizationPolicy, feature_category: :cell do
 
   subject(:policy) { described_class.new(current_user, organization) }
 
+  context 'when the user is anonymous' do
+    let_it_be(:current_user) { nil }
+
+    it { is_expected.to be_allowed(:read_organization) }
+  end
+
   context 'when the user is an admin' do
     let_it_be(:current_user) { create(:user, :admin) }
 
     context 'when admin mode is enabled', :enable_admin_mode do
       it { is_expected.to be_allowed(:admin_organization) }
+      it { is_expected.to be_allowed(:read_organization) }
     end
 
     context 'when admin mode is disabled' do
       it { is_expected.to be_disallowed(:admin_organization) }
+      it { is_expected.to be_allowed(:read_organization) }
     end
   end
 
-  context 'when the user is not an admin' do
-    let_it_be(:current_user) { create(:user) }
+  context 'when the user is an organization user' do
+    let_it_be(:current_user) { create :user }
+
+    before do
+      create :organization_user, organization: organization, user: current_user
+    end
 
-    it { is_expected.to be_disallowed(:admin_organization) }
+    it { is_expected.to be_allowed(:read_organization) }
   end
 end
diff --git a/spec/policies/packages/policies/project_policy_spec.rb b/spec/policies/packages/policies/project_policy_spec.rb
index 5c267ff5ac5..fde10f64be8 100644
--- a/spec/policies/packages/policies/project_policy_spec.rb
+++ b/spec/policies/packages/policies/project_policy_spec.rb
@@ -127,5 +127,30 @@ RSpec.describe Packages::Policies::ProjectPolicy do
 
       it_behaves_like 'package access with repository disabled'
     end
+
+    context 'with package_registry_allow_anyone_to_pull_option disabled' do
+      where(:project, :expect_to_be_allowed) do
+        ref(:private_project)  | false
+        ref(:internal_project) | false
+        ref(:public_project)   | true
+      end
+
+      with_them do
+        let(:current_user) { anonymous }
+
+        before do
+          stub_application_setting(package_registry_allow_anyone_to_pull_option: false)
+          project.project_feature.update!(package_registry_access_level: ProjectFeature::PUBLIC)
+        end
+
+        it do
+          if expect_to_be_allowed
+            is_expected.to be_allowed(:read_package)
+          else
+            is_expected.to be_disallowed(:read_package)
+          end
+        end
+      end
+    end
   end
 end
diff --git a/spec/policies/project_policy_spec.rb b/spec/policies/project_policy_spec.rb
index 602b7148d0e..2854d6daece 100644
--- a/spec/policies/project_policy_spec.rb
+++ b/spec/policies/project_policy_spec.rb
@@ -2736,26 +2736,62 @@ RSpec.describe ProjectPolicy, feature_category: :system_access do
           expect_allowed(:build_read_container_image)
         end
       end
+    end
+
+    context 'with external guest users' do
+      where(:project_visibility, :access_level, :allowed) do
+        :public   | ProjectFeature::ENABLED  | true
+        :public   | ProjectFeature::PRIVATE  | false
+        :public   | ProjectFeature::DISABLED | false
+
+        :internal | ProjectFeature::ENABLED  | true
+        :internal | ProjectFeature::PRIVATE  | false
+        :internal | ProjectFeature::DISABLED | false
+
+        :private  | ProjectFeature::ENABLED  | false
+        :private  | ProjectFeature::PRIVATE  | false
+        :private  | ProjectFeature::DISABLED | false
+      end
+
+      with_them do
+        let(:current_user) { guest }
+        let(:project) { send("#{project_visibility}_project") }
+
+        before do
+          project.project_feature.update!(container_registry_access_level: access_level)
+          current_user.update_column(:external, true)
+        end
 
-      def permissions_abilities(role)
-        case role
-        when :admin
-          if project_visibility == :private || access_level == ProjectFeature::PRIVATE
-            maintainer_operations_permissions - admin_excluded_permissions
+        it 'allows/disallows the abilities based on the container_registry feature access level' do
+          if allowed
+            expect_allowed(*permissions_abilities(:guest))
+            expect_disallowed(*(all_permissions - permissions_abilities(:guest)))
           else
-            maintainer_operations_permissions
+            expect_disallowed(*all_permissions)
           end
-        when :maintainer, :owner
-          maintainer_operations_permissions
-        when :developer
-          developer_operations_permissions
-        when :reporter, :guest
-          guest_operations_permissions
-        when :anonymous
-          anonymous_operations_permissions
+        end
+      end
+    end
+
+    # Overrides `permissions_abilities` defined below to be suitable for container_image policies
+    def permissions_abilities(role)
+      case role
+      when :admin
+        if project_visibility == :private || access_level == ProjectFeature::PRIVATE
+          maintainer_operations_permissions - admin_excluded_permissions
         else
-          raise "Unknown role #{role}"
+          maintainer_operations_permissions
         end
+      when :maintainer, :owner
+        maintainer_operations_permissions
+      when :developer
+        developer_operations_permissions
+      when :reporter, :guest
+        guest_operations_permissions
+      when :anonymous
+        anonymous_operations_permissions
+      else
+        raise "Unknown role #{role}"
       end
     end
   end
diff --git a/spec/policies/work_item_policy_spec.rb b/spec/policies/work_item_policy_spec.rb
index 3d282271d60..bd8f5604eba 100644
--- a/spec/policies/work_item_policy_spec.rb
+++ b/spec/policies/work_item_policy_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-RSpec.describe WorkItemPolicy do
+RSpec.describe WorkItemPolicy, feature_category: :team_planning do
   let_it_be(:group) { create(:group) }
   let_it_be(:project) { create(:project, group: group) }
   let_it_be(:public_project) { create(:project, :public, group: group) }
@@ -201,4 +201,24 @@ RSpec.describe WorkItemPolicy do
       end
     end
   end
+
+  describe 'admin_work_item_link' do
+    context 'when user is not a member of the project' do
+      let(:current_user) { non_member_user }
+
+      it { is_expected.to be_disallowed(:admin_work_item_link) }
+    end
+
+    context 'when user is guest' do
+      let(:current_user) { guest }
+
+      it { is_expected.to be_allowed(:admin_work_item_link) }
+    end
+
+    context 'when user is reporter' do
+      let(:current_user) { reporter }
+
+      it { is_expected.to be_allowed(:admin_work_item_link) }
+    end
+  end
 end